Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-07T14:08:45 kernel: kernel: Denial of service via use-after-free in ALSA Line 6 audio driver 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-825

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read. Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Line 6 USB audio driver. When releasing audio capture buffers, the driver fails to clear an internal buffer pointer, leaving a stale reference to freed memory. A local user can exploit this issue by triggering audio playback after closing a capture stream, resulting in a use-after-free condition that may lead to a denial of service (system crash) or unauthorized memory disclosure.

This vulnerability is evaluated as having a Moderate impact because exploitation requires local access and the physical presence or attachment of specialized Line 6 USB audio hardware. An authenticated local attacker could leverage the dangling buffer pointer to crash the system and cause a denial of service, but remote exploitation is not possible. Standard Red Hat Enterprise Linux deployments rarely interface with these consumer audio devices, severely limiting the attack surface in production environments. Prevent the snd-usb-line6 kernel module from being loaded. 1. Add configuration files to /etc/modprobe.d to disable module loading: # echo "install snd-usb-line6 /bin/true" > /etc/modprobe.d/disable-snd-usb-line6.conf # echo "blacklist snd-usb-line6" >> /etc/modprobe.d/disable-snd-usb-line6.conf 2. Unload the module if it is currently active: # modprobe -r snd-usb-line6 Caveats: Disabling this module prevents the system from interfacing with any connected Line 6 USB audio hardware. Warning: If the module is currently in use by running processes or sound daemons, unloading may not succeed immediately and a system restart will be required for the change to take effect. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99271 https://nvd.nist.gov/vuln/detail/CVE-2026-99271 https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31 https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7 https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222